Extracted

• • Target

    a1893881bbe22b313821f0aae0c3fe4f_JaffaCakes118

  • Size

    302KB

  • MD5

    a1893881bbe22b313821f0aae0c3fe4f

  • SHA1

    27fdd81ca8d3a6b12d5ba005271ab09443fddd30

  • SHA256

    64ec0056248b813042d7cc890395f83649885ed06a81b676a4cd60016fa3c60b

  • SHA512

    feb6df4db7e70c3545b0db7c204624ff3342bcdd347f5887d9bbc2a9980ba8c1bfcbbe028879d3c162a484b906e7311f086b61739545abd5c64414a6c310e33a

  • SSDEEP

    6144:1k4qm2z6YOcBZLIr9N82x4szzGJPaSemWLMtN3tkMb:S9j6cBZLIxysza4StWCkI

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2